Re: [PATCH manager/access-control 0/3] fix #7513: fine-grained ACL for node certificates

["Michael Köppl" <m.koeppl@proxmox.com>]

Thanks for these patches! Gave this a quick spin by creating a new user
and assigning the now more specific permissions.

- Checked that assigning the CertManager Role to the new user for path
  /nodes/<node>/certificates was possible through both the UI and pveum
- Checked that the user then was able to view, upload, and remove
  certificates for the nodes for which the path was added (and that it
  was not possible for other nodes)
- Checked that assigning the CertManager role for path /nodes/<node>
  still allowed the user to manipulate certificates
- Also checked that the user could not access any other functionality
  even if assigned a role with more privileges

The patches seemed to work as expected for me. I also had a look at the
code and the changes look simple enough and good to me. I quickly
checked if any other parts of PVE might be affected by these changes,
but I don't think that's the case.

Consider this:
Reviewed-by: Michael Köppl <m.koeppl@proxmox.com>
Tested-by: Michael Köppl <m.koeppl@proxmox.com>

On Thu May 28, 2026 at 1:35 PM CEST, Jakob Klocker wrote:
> Managing node certificates currently requires broad /nodes/{node}
> permissions, which violates the least-privilege principle. This
> series adds /nodes/{node}/certificates as a dedicated ACL path and
> moves the relevant permission checks onto it, so certificate
> management can be done without granting node-wide rights.

[snip]